ci: stop upstream-only workflows in the fork (#84)

[geeen-jp]

Summary

• Stop upstream-only GitHub Actions in the geeen-jp fork. Deleted workflows no longer run on push, pull request, issue, schedule, or release. Publish workflows start only from workflow_dispatch and skip unless confirm matches an exact string. Evaluation workflows start from dispatch or a PR label.
• validate (job name unchanged), Python/REST/OpenAPI compatibility checks, and TypeScript CI stay. version-bump-guard, review-thread-gate, and pr-description-check stay as local rules. pr-description-check now uses pull_request and passes no token, so the ready-for-dev lookup is skipped. .pr/ is removed by hand before merge.
• Branch issue-84 was rebased onto origin/main 5191d6ad (sdk#79 PR test: isolate terminal tests with ephemeral ports and process-group cleanup (#79) #81, terminal teardown). The three commits are c5564c5f7, 9feb365e3, ee41f2b5b. Workflow files are unchanged from the pre-rebase tip 3174faa53.

Workflows

Workflow	Triggers	Kept	Removed / manualized
deploy-docs.yml, cancel-eval.yml, prepare-release.yml, version-bump-prs.yml, create-release.yml, stale.yml, issue-duplicate-checker.yml, remove-duplicate-candidate-label.yml, todo-management.yml, issue-readiness-check.yml, pr-artifacts.yml	none (files deleted)	none	former push / dispatch / cron / issues / issue_comment / pull_request_target / merged rel-* PR triggers
pypi-release.yml	workflow_dispatch (confirm = publish-pypi)	publish steps; contents: read	release / workflow_run auto start; actions: write; dispatch of version-bump-prs.yml
typescript-client-npm-publish.yml	workflow_dispatch (confirm = publish-npm)	npm OIDC publish	auto start on release
typescript-client-github-packages-publish.yml	workflow_dispatch (confirm = publish-github-packages)	GitHub Packages publish	auto start on release
run-eval.yml	workflow_dispatch, or pull_request_target labeled	same-repo labels run-eval-1/50/200/500	runs on ordinary unlabeled PRs and on release
integration-runner.yml	workflow_dispatch, or pull_request_target labeled	same-repo integration-test / behavior-test	unlabeled PRs; id-token
run-examples.yml	workflow_dispatch, or pull_request labeled test-examples	unchanged otherwise	unlabeled PRs do not start it
security-scan.yml	workflow_dispatch, or pull_request labeled	security-scan, or any label on a rel-* PR	unlabeled non-rel-* PRs
pr-description-check.yml	pull_request	job Validate PR description; linked-issue reference and template sections	pull_request_target; issues: read; GITHUB_TOKEN env
validate.yml	pull_request	job/check name validate	none
tests.yml, precommit.yml, docstring/deprecation/example checks, API breakage, persisted-settings, typescript-client-ci/integration-tests/endpoint-audit, server.yml, release-binaries.yml, version-bump-guard.yml, review-thread-gate.yml	unchanged	Ubuntu local checks	none

Inventory, guards, and how to restore a deleted workflow are in .github/workflows/README-RELEASE.md.

Required checks 移行

Deleted workflows (checks that can no longer be produced):

• dispatch (deploy-docs.yml)
• cancel-eval (cancel-eval.yml)
• prepare-release (prepare-release.yml)
• create-version-bump-prs, bump-typescript-client (version-bump-prs.yml)
• create-release (create-release.yml)
• stale (stale.yml)
• smoke-clone, issue-duplicate-check, auto-close-duplicates (issue-duplicate-checker.yml)
• remove-duplicate-candidate (remove-duplicate-candidate-label.yml)
• scan-todos, process-todos, summary (todo-management.yml)
• check, Refresh PR gates for linked issues (issue-readiness-check.yml)
• cleanup-on-approval, check-pr-artifacts, cleanup-after-merge (pr-artifacts.yml)

Still present, with a narrower trigger:

• publish (pypi-release.yml, typescript-client-npm-publish.yml, typescript-client-github-packages-publish.yml) — skipped unless dispatched with the matching confirm
• print-parameters, build-and-evaluate (run-eval.yml) — skipped on fork PRs and on release
• Validate PR description (pr-description-check.yml) — kept; trigger is pull_request

Main branch protection is unconfirmed: GET branches/main/protection returns 403 and the rulesets API returns []. Settings were not changed. The operator must check the GitHub UI and drop any required check in the deleted list. The same note is in .github/workflows/README-RELEASE.md under "Required checks 移行 (sdk#84)".

Unchanged on ordinary PRs: validate, build-binary-and-test (ubuntu-latest), check-openapi-schema, Check package versions, the review-thread gate, and the TypeScript client checks.

Static checks

Recorded on pre-rebase head 3174faa531b2a2221de5154fd4c0a341266461d4 (static-checks.txt). Rebase onto 5191d6ad did not change any .github/workflows file (git diff 3174faa53 ee41f2b5 -- .github is empty). actionlint v1.7.12: 0 findings on the six changed workflows that remain (integration-runner.yml, pr-description-check.yml, pypi-release.yml, run-eval.yml, typescript-client-github-packages-publish.yml, typescript-client-npm-publish.yml) and 0 on the same files at origin/main (no new findings). yaml.safe_load of every .github/workflows/*.yml: PASS. Needs-graph: every needs: target exists in the same workflow; no job depends on a removed job. Local uses: workflow files still exist. No Windows, macOS, or arm64 job line in the changed workflows. PASS.

GitHub Actions did not run (Actions are restricted on this repo).

make validate

Earlier acceptance runs failed only on unrelated flakes. SDK source was left unchanged.

• On 3174faa53: make validate rc 2 after 254s. tests/sdk/conversation/test_fifo_lock.py::test_fifo_lock_timeout (0.262s > 0.2s, sdk#89). An earlier run on that same head was SIGTERM'd during tools (rc 143).
• A later run failed tests/tools/terminal/test_terminal_session.py::test_bash_background_server on port 8081 (tmux and subprocess). sdk#79 PR test: isolate terminal tests with ephemeral ports and process-group cleanup (#79) #81 (5191d6ad) fixed that teardown.
• After the rebase, accept-validate-chain6-try1.log on ee41f2b5b8cc0661eb2e7fe276f4eca6175585db failed test_exit_code_top_level_soft_timeout[subprocess]: sleep 2 finished with exit code 0 before the soft timeout (tools suite rc 1).

Final run on that same head, log accept-validate-chain7-try1.log: rc 0. Suite seconds sum to 996s.

Suite	Status	Seconds	Counts
sync	pass	0
sdk	pass	149	6124 passed, 7 skipped, 10 xfailed, 671 warnings
agent_server	pass	73	2083 passed, 1259 warnings
workspace	pass	21	191 passed, 4 warnings
cross	pass	163	438 passed, 1 skipped, 1 deselected, 317 warnings
tools	pass	494	948 passed, 17 skipped, 1 warning
pyright	pass	58
pre-commit	pass	38
git-diff-check	pass	0
git-diff-exit-code	pass	0

git status --porcelain is empty on this head.

Closes #84

[github-actions]

📁 PR Artifacts Notice

This PR contains a .pr/ directory with temporary PR-specific documents. The directory will be automatically removed when the PR is approved.

[github-actions]

Endpoint audit

⚠️ 18 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	18
Documented non-divergences	13
Agent Server contract operations	129
Audited handwritten client endpoints	119

Actionable client-only calls (0)

none

Actionable server-only operations (18)

• DELETE /api/canvas-extensions/installed/{}
• DELETE /api/llm/provider-connections/{}
• GET /api/canvas-extensions/installed
• GET /api/canvas-extensions/installed/{}
• GET /api/canvas-extensions/installed/{}/bundle
• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• GET /api/llm/provider-connections
• PATCH /api/canvas-extensions/installed/{}
• PATCH /api/llm/provider-connections/{}
• POST /api/canvas-extensions/install
• POST /api/conversations/{}/load_plugin
• POST /api/file/create_directory
• POST /api/init
• POST /api/llm/provider-connections

Documented non-divergences (13)

Client calls intentionally absent from the filtered contract (11)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands#3744

• POST /api/profiles/{}/validate

Reason: Client-ahead API stacked on the pending Agent Server pre-flight LLM validation endpoint.
Owner: OpenHands TypeScript client maintainers
Tracking: OpenHands#4422

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log